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SUBJECT: Anonymous Operations Scheduled for November 5, 2013 - Million Mask March 
and OpForTheLulz 

OVERVIEW: 

Million Mask March 

The Million Mask March on November 5, 2013, also referred to as OpNov5th, is an international 
Anonymous-organized event in honor of Guy Fawkes Day in the United Kingdom. Anonymous 
advertises the march as a peaceful demonstration, which is protected by the Constitution, drawing 
attention to causes ranging from basic human and civil rights to grievances against the current 
“oppressive and tyrannical government.” Anonymous actors are organizing demonstrations in over 150 
US cities. Attached to this email is a list of US cities and states with scheduled demonstrations, 
as well as the Facebook pages for each event. 

While this is supposed to be a peaceful protest, Anonymous indicates they are prepared for the “same 
type of unprovoked violence from law enforcement that happened during the Occupy rallies." No threats 
of violence have been made; however, Anonymous is preparing their own "medical teams" to treat 
demonstrators who may be injured in the event of law enforcement intervention. Additionally, law 
enforcement should be aware of participants using mobile phones to record interactions with law 
enforcement and other authorities. Some smartphone applications can automatically broadcast the 
recordings online or make the phone appear to be off by displaying a black screen while recording. 

On October 28, 2013, Anonymous released a YouTube video ( http://www.voutube.com/watch? 
v=3HRd16GCaJc1 with a message to the Washington, D.C., police stating that if there are 
unlawful arrests of protestors, or if police interfere with protestors who are recording the event, 
Anonymous will target their “servers, phone lines, emails, and whatever else they can 
find.” While this message is specific to the Washington, D.C. march, law enforcement agencies should 
consider it applicable to other Million Mask March locations. 

Cyber Threats 

In addition to the Million Mask March, members of Anonymous posted OpForTheLulz, targeted towards 
individuals who conduct cyber attacks for personal entertainment, or “lulz.” The video advocates 
attacking "whoever you want on November 5th with whatever means necessary to take down your 
target." An OpVendetta demonstration is also planned for November 5 th around London, England, and 
includes some generic threats of cyber attacks. While both of these operations may include cyber 
attacks, they are not organized efforts and no US targets or tactics have been posted by Anonymous 

members or affiliates. If cyber attacks are conducted on November 5 th , they will likely be disorganized 
and on a small scale. 









REFERENCES: For further information please see the links below: 


http://www.diaitaliournal.com/article/358356 

http://www.diaitaliournal.com/article/358726 

http://www.voutube.com/watch? v=jGIGDeFcdo8 

http://www.voutube.com/watch?v=4 01 OFXrl B8 

http://www.millionmaskmarch.ora (This is an Anonymous website; CIS does not recommend 
accessing it from an agency computer due to the possibility of Anonymous monitoring visitors and/or 
compromising visiting computers with malware.) 

RECOMMENDATIONS: 

We recommend the following actions be taken: 

Remind users not to visit un-trusted websites or follow links provided by unknown or un¬ 
trusted sources 

Remind users to be cautious when clicking on links in emails coming from trusted sources 

Ensure anti-virus is installed and definitions are up to date 

Ensure patches and updates are installed for operating systems and applications 

Run regular vulnerability scans against the network and web applications 

Ensure law enforcement authorities are aware of the planned demonstration site and the 

potential for antagonistic behavior and cover recording 

The Center for Internet Security (CIS) will continue to monitor Anonymous operations scheduled for 
November 5, 2013 and will inform affected parties as necessary. 

The Center for Internet Security 

31 Tech Valley Drive 

East Greenbush, NY 12061 

518-266-3488 

7x24 SOC 1-866-787-4722 

soc@cisecuritv.ora 


TLP: AMBER 

Recipients may only share TLP: AMBER information with members of their own organization 
who need to know, and only as widely as necessary to act on that information. 

If information is disseminated to non-government agencies under TLP: AMBER, remove all 
attribution to the Center for Internet Security (CIS). 
http://www.us-cert.aov/tlp/ 

This message and attachments may contain confidential information. If it appears that this message was 
sent to you by mistake, any retention, dissemination, distribution or copying of this message and 
attachments is strictly prohibited. Please notify the sender immediately and permanently delete the 
message and any attachments. 










